Use iptables to block DNS query for a domain name

Now there is a demand, it is necessary to prohibit the host DNS query for a domain name, think of using iptables string module, use the following command:

iptables -D OUTPUT -m string --string "www.baidu.com" --algo bm -j
DROP

However, the above command does not filter the query to the www.baidu.com. According to the reference link in the document, www.baidu.com in the DNS query will be coded as follows:

03www05baidu03com

When encoding domain of each dot is divided into sub-strings (www, baidu and com) "." Not coded, preceding each substring of string length. Here is the capture of DNS queries:

string www.baidu.com is encoded in hexadecimal:

03 77 77 77 05 62 61 69 64 75 03 63 6f 6d

77 is w ascii code, the control may be ascii characters remaining query. 777777 03 is in front of the three of the string length www.
The reference links, hexadecimal string iptables string module may be used to filter

iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "|03|www|05|baidu|03|com|" --algo bm -j DROP

iptables automatically

|03|www|05|baidu|03|com|

Converted to hexadecimal.
Reference links:
https://linuxsecurity101.com/2018/11/18/tips-and-tricks-blocking-dns-requests-via-iptables/